exhibit j - american civil liberties union · rajesh de general counsel ... case 1:13-cv-09198-at...

EXHIBIT J

Case 1:13-cv-09198-AT Document 71-11 Filed 04/20/16 of 22

'fOP SRCRE'i'/lSI//'fALF:N'f K::EYUOLE/tNOFORN

NATIONAL SECURITY AGENCY CENTRAL SECURITY SERVICE

fORT GJ::ORG!=, (?.MEADE M.f\RYL.Af\10 :20755.-6000

4 March 2013

MEMORANDUM FOR THE CHAIRMAN, INTELLIGENCE OVERSIGHT BOARD

THRU: Assi~t~nt to the Secret~ry of0f:lfensf:l (lntt!llige11ce Oversi~ht)

SUBJECT:· (LJ//fQt!Q) Report toll1e lnt~llig~;:nce Oversight Board on ~SA Activiti.es ~ IN FORMA TlQ~ MEMORANDUM

(U//fOUO) Except as previously reported to you or the President, or otherwise stated inthe enclo~ure, we have 11() reason to peHeve that intelligence activities oftheNational Secmrity Agency duri11g the quarter ending 31 December20 12 were t:mlawful or contrary to Executive Order or Pre~idential Directive and thus should have been reported pursuant to Section 1.6(c) of Executive Order 12333, as .amended.

(U/If'eU~ The Inspector General and the General Counsel continue to exercise oversight of Agency activities by inspections, surveys, training, revic.'!w ofdirectives and guidelines, and advice and COI,ll1SI;JL . .

.)( ... ~ QEO~ARD . · .. ·. ·.

Inspector Gel1erid

~/'\_ ~ RAJESH DE

General Counsel

(U//FOUO) I concur in the report of the Inspector General and the General Counsel and hereby make it our combined report. ·

Encl: Quarterly Report

KE;fJLEd£f General, U. S. Army

Director, NSA/Chief, CSS

This document may be declassified and marked "UNCLASSlFlED//Fm Official Use Only" upon rellloval of enclosure( s)

E\pproved for Release by NSA on 12-19-2014. FOIA Case# 70809 (Litigation)

TOP SECRET//SIJ/'FALEN'f lffi'i'IIOLE/1NOFORN


:OOCI:O: 4165220 fOP St!:Ctu!T!7'f5flt'ALEiVf llt!: YtfOLE;7'NOfi'OltN

I. (U) Intelligence, Counterintelligence, and Intelligence -Related Activities that Violated Law, Regulation, or P.olicy and Were Substantiated during the Quarter, as well as Actions Taken as a Result of the Violations

I.A. (U) Intelligence Activities Conducted under Executive Order (E.O.) 12333 Authority

(U//FOUO) Some incidents may involve more than one authority (e.g., E.O. 12333, NSA/CSS Title I Foreign Intelligence Surveillance Act (FISA), FISA Amendments Act (FAA). Incidents involving more than one authority are included in the section for each inyolved authority. Thus, a single incident may produce multiple entries in this repOli., ............... (~ l) ((

1 l)

...... (JJ .. 3 -P.L. 86-36

IA 1 (u)u . · IT . 0

b 0

. . ... ······u····. (JJ}.(3)-sousc3oz4(i) . . mntent1ona argetmg or ata ase uenes ag_;\lnst mted sta.tes

Persons (USPs) or Foreign Persons in the United, .. Sfates ·

(37'/SI/JML 'fO USA, fiVEY) During the fqwti{'q~~atier of calendar year 2012 (CY2012), the National Security Agency/Central Security,:Sei~ice (NSA/CSS) continued I l I .. lKs part ofthat process, duplicate selectors were removed and the number of active s~ledors was reduced. At the end ofthe fomih qumier of CY2012, NSA/CSS 's primary)aski'i1g tools for telephone and Internet selectors contained approximately I I active selectors.

. .. (b) (3)-P.L.

(U//FOUO) During the fourth qumier of CY20 12, in Di11stru1ces, signals intelligence (SIGINT) a11alysts inadvertently tm·geted communications to, fi:om, or about USPs, while pursuing foreign intelligence tasking or performed mistaken queries that potentially sought or returned information about USPs. Unless otherwise specified, all intercepts, query results, a11d reports have been deleted or destroyed as required by United States SIGINT Directive SPOOlS.

I.A.1.a. (U) Tasking Errors

(TSf/81/fREL TO USA, FV'E"Y) I I an analyst discovered that selectors associated with a USP had erroneously been tasked because tl1e ru~~lyst had overlooked information about the tru·get's USP status. All selectors associated witl1 the tm·get were detasked,

and all :~=~:: ;;s;:::W"l) I lan.analyst drsc~:~;e~ t!rat a selector for a foreign intelligence target that had been detasked was subsequently i;etaskedwlii~~ the

86-36

target was in the United States. The analyst detasked the selector I ' ' ''T i~ ~ i; ~ _ P. L. 86-36

(S//SI//REL TO USA, FVEY)I F~i~i~~~~ di~covt)i:ed that selectors associated with forei n intellig(!uce targets that had be~n pl:eviously det~sked because

wei'e i·etasked while thetargets were in the l)ruted States. All ..._,.....~----r-'T"""'T"""ru-1d'T"""n-o-c"""o lection occurred. ..· ·

(T3h'31NN¥)1 ~fi;1~~~~st discovered thatOselectors associated with a USP had been erroneously tasked because information about the target's USP status was

Deril'ed From: NSA!CSSllJ 1-52, dated 20080107

I ... 1 DeclassUy Vu: 2038()3'fU

fO"P 1S"F:CRETt~'f1l"'·/PALE1VT j'(E J[{l(JLE;S~rOPOltl{ .. ··········

(b)(1) (b)(3)-P.L. 86-36


DOCID: 4165220 .··'"(.p) (1)

..::P,~~~fHI:'.!f!h'!H-J~~r;!NT-Irni..WHtr.F:~'ft'JfflR···~·····r-· .. . (h.) ( 3) - P. L. 8 6-3 6 TOP 8ECREf1HYI/fALE1\'1' KEri:lfJtE_<'.clfJJFOitlvr (b)-.....(__3) -5o usc 3024 (il

not provided by an Intelligence Community (IC) ... custo'i~~l: .. :~len the selector was beit~~--'--. ..,_ researched for tasking. The selector was_cJ..etasked, and all data was..9.~.l.eted._l -----~__.

············

.. wei:e·e:rrcnieol.isly targeted and collection occurred for 39 minutes

-~~~;~~~~~-~L·: 86~36... .. .(isif.§f.;~~L'fCftJSA~ JV'vtri)l I an analyst mistakenly requested tasking of his owii' p'ei'sonal identi.p~r instead of the selector associated with a foreign intelligence target. The selector was.cfefaskedl I

•'(b.) ( 1)

I.A.1.a.i. (U) Unauthorized Targeting (b)' ·{3 ) - P . L. 8 6-3 6 (b) (3'):-50 usc 3024 (i)

(TS//Sih~'fl!}l l.an·-m1ruyst ... di~covered that a tele hone selector·. associa.t.ed-·with a USP, fonnerJy.appro\red for tar etin under a

......... ) .......... ·· 1-.was •. tasked·· .......................... I.h~ ... s.e~.;.l-e.c-=t-o-r .. -.w-a-s""": ... r-e":""ta-s~""-e-·"'· ---.----' '"'"'';;;;;;;;;;;;,;;;;;;,;;,,,.,""J. ......................................... ··· ..... j:AdestmctiOTfWruver 1as een requested, and a request for FAA§ 704 \N:tl-) ......... ~uthorization has been submitted for fhture targeting. (b) ( 3}-:::P. L ...... 86,3.6

···- ..

r--....:;;;.""""-""~:.;,;..::::..:..:...;;:..!..../---:-;-----:--:---:::--~ an analyst discovered that data had been collected .. n.th.~. selector for a foreign intelligence target when the target was in the

·········· ............................. ························ '"··~:(~~-) ( 1}

I.A.1.b. (U) Database Queries

[(ii/C'T//T>nT 'T'n. TTCI n~ TT""-T-',1 ''--'-' ~, .L • .w .L I

(b\.(3) -P. L. 86-36 (b).(:3.) -50 usc 3024 (i)

. ·. '• '.

··· ..... 1

(U//fOUQ.j OnOoq~asions during the fomih quatier, analysts performed overly broad or poorly constructed database ql.leriesJhat potentially selected or returned information about USPs. These ueries used

t~1at produced imprecise .._--r.~~..,---,r-o""ft~l-o-se-..... -o-cc_a_s.,...to-n-s.-. t~1_e_q_u_e...,n_e_s -re-:-t-ut-·n-e..,.-r~esr-u-rt:-s-., __ w.,...,ucli were deleted 01:\aged of£ as required, and no rep01ts we'i'e issued. AnCilys.ts who performed these guei'ieswere c6,m1seled by their management.

(U) Procedural and other errors contributed to the following incidents: (b) (3)-P.L. 86-36

• (SNSIHREL TO USA, FVE}'}On0occasions during the fomih quarter, NSA analysts performed qu~xies inrawfraffic databases without first conducting the necessaty research

(b) (~;······································ ·····

(b)(3)-P.L. 86-36 'fOP SECttEfi7Sf/'fALEjVf J(E J'tfOLE!lNOFtm.Jv

2


DOC:ID: 4165220

0

•

f(jfJ 8"ECttEf;781/fJiLEltT ifE l'N-OiES?JVo:F-OR1V

on the selectors. When the queries returned results, they were deleted and no reports were issued.

I J .. NSA. .. had .. detasked..the ... selector..b.e.c.aus.e..Jh.e..J!M:g~.L.W..~$. . ..i.P..t.h~ ... Y.~!.f:!4 ... §.!~~-~-~, .. ::+.fhe query results were deleted! f............. . ................................. ··:::::::::::::::: ... ···· (b) ( 1)

· · ·· . . (b) ( 3) - P. L. 8 6-3 6

ai1 .. ~~;~~;~~ performed a query in a raw '(:~)·· 1)

.·.3)-P.L. 86-36 (b}·.-(3-)-50 usc 3024 (i)

• (8/IREL TO USA, FVii?t) 1

·········· ....

• (8//8IHREL TQ Y$.A, ... F'.i19J.Y} a database auditor discovered that an ....................... ·analy~Lh~d:::iii:Lstak.enly..performed queries in a raw traffic database on the selectors for

·~f;.~:F:i:;t:~:::::::;::;:::::::::::::::::::::::::::::.ii~reign intelligence target in the Umted States. The analyst deleted the results.

(b):'(··~.). -:~::·::L· .. :::S.!J.~~~~:.J~:tPiEL'"'f0'y£A'~'Ji'YE¥)1..................... I an anal st erfonned a query in a raw -... ......... ··. ·:::- traffic database .. on a seleetotthat-·had . .b.eencl"efei'Ti1ined·· to be associated

.. . .. ::::·.···...: ... with a USP. Th~·aii."alystde.l.eted the qu~;y···aiicrtesults

...... \_··.··.·.· .. •.·.· .. ·.··· .. ·.··.•. (:s)/5,Ih~L 'fO ~~~~-::v;lr;,; .. ~;;;;; .. d_a...,ta~~.:.:_se_:_o_n_s_el_e_et_n_rs...! ... !::as=.~=o=ci=a=te=d=w=it=h=a=t=ar=·g!..e_t _w_h_e_n-it_w..,.· as

•

he United ·sfafes.. '

·. ' selector associated with a USP

. The analyst then sent th~ r€1SulW ... o""';!f~tl:-le~qt-~e-ry~t-o-a-no-t~h-er-· -ar-la-:1-ys~t-. ""';!So:-u~b-se_q_u_e-nt':":"ly-,-t-:h-e-ru-1-al:-y.....Jst 'l~arned that the selector /w~s

1 ·

registered to a USP. The analyst recalled the e-mail ar1d dei'eted all query results. ! i ./

• (TS//SINNF)I I analys~s selected an incqn:ect/' database when performing queries on selectors associated with fqreign intelligen¢e' t~{gets.

·(b){l) No results were returned. \ ! 1 i (b) (3).:::i?:i.. 86"'36 \ j •. /

• ··· (TSHSI//l'W) I I a database auditor discovered tli~t an analys.i /hctd nlistakenly p.~r~fonned a query on a target authorized under FAA §705(b)l .1 I p-t~awJrCi:f.:fi2 database during the time the tru·get was in the.Vnitedf1&tates. The query and results were defete~ I \. if/ ./

······································· ············ ······················ ....... \\k)(l)

T0;9 8ECRET1$'6'I/TALEl'lrT i'iEJ'l.i''OLE;~'NOFORPl 3

(b) (3) -P.L. 86-36 (b) (3) -50 usc 3024 (i)


:OOCI:O: 4165220

• (~UJgi/fRBL TO USA; FYJ.3..Y) I I an analyst discovered that a query was performed on a seleqtorassociated with a foreign intelligence target while the target was in the United States:··

.. ·····

• (T..S#Sihc.RBL TO U§t\; FYEY)···L.....;,::;---:---:-----~~-:---~--:::---:-------' ..... · :1 liii .. a raw traffic database on one of the selectors for a foreign

. ··''"''"''''':::::: ....... -·intelliiitmce tar et who arriy~_d...in..the .. .United. States·! I The analyst was ·········· .............. because of database access problems. The

·. ·.

•

•

-~~y,q~f::-:lFe-~m:-:F~'¥11.__=----~"""":"'"--'1 an analyst performed a query in the The query and the results were deleted immediately.

an analyst unfamiliar with a query tool performed a que~ ·i~~-a i'aw ..... -:-.tr-.~il-rffiv:-c--;d-at:-a;-b-as-er===---..::._-------..!.,_...;::., No results were returned. (b)(3)-P.L. 86-36

.... ~:iti:O:J:6::1:f::b:C:::::I::::!I±I::l:l~~:-¥-(b) (3)-50 usc 3024(i)

................................ ,,,,,,,,,,,,,,,,,,,.b:e.~!:U!:S:e....._----;r-r--:--r---------...1 ··(:b·· ... , :~~:;:_l!.:=··.················8····6····::::resnh.S. .. Y!.e .. re deleted.

J. \ ~- ·. ·E' ··1.. 3 6 ······ ······ .... · ···:::::::::::;::··::~::::: (8/f..~I//REL 'fO·ugX~··F\iT:rr;l I an analyst performed a query in a

. . ··.::::::· .. )•aw..ti'afficgatabase on a list of selectors that included one associated with a USP. Upon · · ··di?eo.\/ery.o.fthe··errqr, the analyst stopped the query and removed the selector.

..._ · ... • (S~;~I;t~L:To·ugA,~f\iE¥)1 I an analyst included a U.S. e-mail

•

·. address instea:d ofthe iiitend..ed target's e-mail address in a quety running in a raw traffic ·database. No iesult.swere reti.itned.

(S;l/S.~h'REL 'fO U~A~---~~"f).---...;;,;,~------.an analyst performed a quety in a raw traffic·qatabase The analyst deleted the resuits without viewing theiit·

~..... (TSH8Ih'N'')I I an analyst performed a query in a raw traffic database \ on a selector associated with a USP. A destruction waiver was approved I I

·1 I · (8/f81/i'R:EL 'fO USA, F\12)11 I an analyst ran a query in a raw traffi_c databas_e on th~ selectors associated with a foreign intelligence tai·:aet while the target was m the Umte.cl States. The analyst deleted the quety and results I _ I (8//SI//R.ELtfO USA, FVPY)· . .· rawtraffic database ohfhe incorrect selector because

•

0

_,,,< : : ~~:~r~~'lueryihnn The query was canceled before L::-ex:-:-e::-:c~u~tl~o-::-n-, ::-:ar::-:1 r"""::"~:-::\:':':'\.(TTb':"l":':(l:"':':!)~ .... ':" .... -.· -.,....-;;.......J

(b) (1) (b)(3)-P.L. 86-36 (b)(3)-P.L. 86-36 (b) (3) -50 usc 3024 (i)

fOP S'ECitEf!J:~I/fALElVf NEJ'ItOLEtlf'ri'Ofi'OIUV 4


.DOCI.D: 4165220 (.j:J) ( 1)

TOP SEC1mT!7S11TALE'Ni 1rEf11()Ll!:77!VO"JftJltjV ..... ... ··

.·······///·········//

(bt(3)-P.L. 86-36 (b) '(._3) -18 usc 798 (b) (3·).-50 usc 3024 (i)

I.A.1.c. (U) Detasking Delays

(3h'Sl//:f.Ui:L 'fO USA, FVEY) A selector asso.oiat~d with a foreign intelligence target ........

I -The delay occurred because I L-----,:-------------------------__.1. No collection occurred.

(g,~tgiJIIU!:I. TO U£ A, I?Vlt:Y)I bt.:was discover~d ... that selectprs fOI0fore.i.g~~.J~~telligence targets had been overlooked for detaskii'ig .. ~nd remaine~ on task/ Upon discovery, the selectors w.ere detasked. · · ·

(Sh'SIHREL 'fO USA, FV~~;;I... . ...... ... . .j.dm:iug ... ~ selectort~~~ie\V1 at\ ru1,alyst

noticed that a selector for a foreign intelligence target that had been:"d'efasked.J. ................... · ··.. . ... ·I

I

·The selector was ·detasked·: · .... :·:::::;:;;;::::;::::;:.''\{b) ( 1) L------------------1 ...... · :::.·· .. (b) (3)-P.L. 86-36

(SNSI//REL TO USA, FYEY) I lw.:heii:~efasl~ing JlS~iedor foi\a foreign intelligence target, an ru1alyst discovered that the selector had ren1.aitied Oli'task wht·\e the target was in the United States. No collectioi}occtfh:ed during the tinw'fhe target was in the\. United States. · ....... ·· · ·.

(3//Sihiti.!.t T<J tJ5A, ; ~-~ ~)I l'ii~~s discovet'ed that selectors for\a foreigti. .. intelligei1ce target had remained on task despite information I I

Othe'United States. All selectors were detasked I r

.. < :· ... ·· _ ..... · "(T'~f/Sih'RELTo~s..A; .. P:VEY)"··s·ei~~t;~~~ i~r· ~;~r-~ign intelligence target remained on ·:> .... ·ta.sk· ........ after NSA analysts had detasked the

·'f:~;.),;::/{~:·:":"::·::::: .... :::f:~~~~~~~~w~~~~l.l ~~J}leJm:ge.thad ... entered .. theHUnited HStates~ I No reports were

(b) (3)-P.L. 86-36-~~~~~~t*~~~~·r-------------~

foreign intelligence targe ~--~----~~~ remained on task despite t 1e su

were detasked ._I ------....J ... :::Ihe..~electors

.L-----"'"""'~HO ·":::::::::,!!!1'\{b) ( 1) ···===="" ,, ........... ..;:··· (-b·) ( 3 ) - P . L . 8 6-3 6

TOP 8ECRET,HW,'fi~LENT IfE YHOLE4JVOlZOR1'l 5


DOCID: 4165220 FOP S£CRET;7'S1/TALEl'lf 1(EJ'lt()LE!tNfJJftn1N

(TSf/Sih'REL TO USA, ~y:e.'.t)l lit was -~-~.S.gQyer.ed.thatO selectors for a foreign i~}t.elligefice target had been ove.tJqoked-wherr6ther selectors tasked under FAA § 702 m1.thority····were detasked..J1ecause··oftlie.iai:get' s U.S. travel. All selectors were d_~.t.asked; .. ai1~ .. !19ll~.complia:ti:fFM §702 data has been marked for purging. It was also

·""'' .. ::::::.: ...... :.:.:::::~:i.:S.~9..Y.¢.:t.@ ... that..the .. selectors in a raw traffic .,~:ti'''f~:;::~:~·::"~~·a.t[-~~~~::=·:.... ..:::::::::········· ............................. and·the·seleetors··were·removed·L----------'

· · ··.. csNsi//REL TOusA:~ .. "FvEY) ··delays in detasking the selectors for a~fo~r-·e':"'"ig-n"'"'i~n-te-:-ll~ig_e_n_c_e~t-ar-·g-e"'"'t -w-:-h-o-:1-la-:d-e-n"'"'te-r-ed~tl~le-U~m':"'".t-ed-:----' States ·· .. r=.;,;;,.;,;;.,a..._ _______ ....,..=;-_'\"""""": ___ ~--;--~--:--~---;-;--:-or-l

T 1e selectors were

(8//SI/;'R:EL TO USA; Pvq:;_¥:)1 I an analyst learned that a selector for a foreign intelligence target .bad·temained on task even though information was known on

..-1 . l~?.g.ut-thetarget's U.S. travel. The selector was?.~t~s.l~-~d .. 1 No collectiOn occnrred. ······························· ...._ ______ ___.

... ······ ..................... --···

.·" · .. ··cs;~;SIHREL TQ.:US:A~::F.ev'fi:¥71 ..... I selectors for foreign ........ iiltelli.g~QqH:argefsW~re.dlscovered to have remained on task, even though related selectors had

.. -::;;;::::::::::::: ............. ,"'""'"bee11.Cietasked because the targets were in the United States. Upon discovery, the selectors were ''(.'S!rt::n=:;;;;::::::::::::::d:etasked:······· .. ····· ( b·) ( 3")·"":P.::;:rJ ; .... 8.§~}''6""'''' :::::::· ... : :::·::.,,;;;; ;;;;;;, :::::::·::::· ······························ ·············

· ·· .......... ::::::c£//&M'REJ? To usA:::'f'r!fr*IT .... t ---.-.. ':"'" ...... _ ..... ~ ...... _ .. ·=~~ valid fm:eign-iQt.elligelice·targ~ts ha\'-I.I..U.¥.l.i.l.loii.L..L1.1..1.1W.....U.UJ.IJoolU-Io.U.W..W...~.U.U.-------....... _j

Althou h inform:ation .. .was availibl in the forwarding ofthe information.

~~~~----~~~~--~~~----------_.~ Upon discovery ofthe infonnatioil· the analyst initiated the detasking. Collection was deleted, and no repo .... tt-:-it-lg--o-cc_u_n-·e-:d-. ---' Tb\ ( 1)

I.A.2 (U)Ir-------..1··· ..... ··································· .. ·················· .. ··

/N INT'tro..-.T 'T',....,.TTN .,-,,,..,...,;r, , ... )/ 'U~l f~'-1-J.l..J ~ V' LJU", ~ ...., ~I I

I.A.3 (U) Unauthorized Access

Colorado (NSAC) that approximate! or training, had had access to the

TOP SECREhS~YET,fLEi'VT lfEJ'i'lOLEtS'P.l0f?OR1V 6

(b).t3)-P.L. 86-36 (b) (3):-18 usc 798 (b) (3)'~50 usc 3024 (i)

············ ........

(b) (1) (b) ( 3) -- P. L. 8 6-3 6

(b) (1) (b) (3)-P.L. 86-36 (b) (3) -50 usc 3024 (i)


DOC:I:O: 4165220 .... -(.];J) (1) (b)._(3)-P.L. 86-36 TOP 8ECRET;S'8ET,4LEi\Vf KEI"J.~.YJtE//fvYJFOltl_Y· (b) (3.) -50 usc 3024 (i) .···

.. -···

I INSAC has begun an in-depth review of all raw SIGINT data sources to ensure that raw SIGINT is being handled properly.

"(b)'T3J'·=p-,.·L-•..... 8_6_:::J.6

... (U/iUOUO}._I ......---:----:--=-~--=~-:-'1 it was discovered that raw SIGINT data was stored on a server not authorized to hold it. The data was deleted and moved to an authorized location. A listing of authorized servers has been compiled to prevent future errors.

I.A.4 (U) Data-Handling Error

(TSHSIHREL TO us.~,.F'liEY) I I an analyst forwarded an e-mail to unauthorized_recipientsthat" included the identities of USPs. The e-mail was immediately .recalled. ···

··r~~::::i:r:::~:.~:··-8·6~3'6(8mH//i>W)I lan analyst forwarded in an e-mail to unauthorized "··--n;~~ipients the results of a raw traffic database query that included terms associated with a USP.

The"e·~m~~~ was recalled the same day.

(C/1~-~X~w)l I NSA issued a memorandum that erro11.~9!~,~.lt contained a US P id entl ty. The memorandum was immediate!~- ~:~.?.~l.l.e.d.--· · · -- ·: : : ::: .:·:;:::;_:_;:;:_::-· ( ~ ~ i ; ~ _ P • L •

(T~://81N:Nf)l lusP-inf~~~~~~~-i~tl wasJt:tadve,l.i;.;~ti~~--r~leased as pati I !were ~wrvett~d for possible USP data. The recipient has submitted a request for evaluated minimiz~d)raffic, . ..-

.· .· ,'

(T~//~IPJU!L TO ugt';:; FVRY) I .· ..... r6~-p il)f~~~mation was released to unauthorized recipients in a chat room. The tnformati911'was recallep·: atld the recipients were instructed to destroy all copies. ,..··"

"'"(T317'3I//REL TO USA, F'/£¥1 .. •" l· .. an NSA analyst provided a file containing raw SIGINT to an IC analyst\vho was not authorized to receive it. Upon discove1y of his mistakq ltiie NSA at1alyst instmcted the IC at1alyst to delete the file.

identity of a U.S. entity had not been mas<i:ed in traffic passed was cat1celed, properly minimized, and reissued ....--_;;...---1'---------"":-----,

purged the traffic containing the unmasked U.S. identity. To prevent a recurreii:ce, ... ·. I lmd _a..;;. __ ::·...,;,_,,,,..~:(:~.;;;.) ........ ( 1)

86-36

I.A.5 (U) Systems Error .... -·········· __ ,.' (hl(3

)-P.L. 86

-36

(I 5//31/i'Nf') .... ! ----------.!it·wasdi~~~vered that a syste~~lr-~-------,· ·1 .__ _______________________ ..~!without sufficient

TQ.P SECRET~~<~'J/TALEl•lT IfEJ'ftOEEI'/!VOFtJ!tN 7


(\b) ( 1) (~) (3) -P. L. 86-36 DOC:ID: 4165220

TOP 8ECRET!S'f1f/fALEi\T lfEYJ.tYJLE;$~rO:PORffi' (~) (3) -50 usc 3024 (i)

'

·r==-====-.;;.;th;.:e;..;s;.,/,jstem's procedures for data ingest, age-off, or purge.\ Information indicated that the data retained in the system includ~d

······· Efforts to ·cb··i·( 1 ) 1 entity t 1e scope oft e pro (b) ( 3) - P. L. 8 6-3 6

I.B. (U) Foreign Intelligence Surveillance Act (FISA)

(U//FOUO) Some incidents may involve more than one authority (e.g., E.O. 12333, NSA/CSS Title I FISA, FAA ). Incidents involving more than one authority are included in the section for each involved authority. Thus, a single incident may produce multiple entries in this report.

(UHFOUQ) Incidents of non-compliance with any authority or approval granted by the Foreign Intelligence Surveillance Comi (FISC) are repmied to the FISC, the Depaitment of Justice, and the Office ofthe Director ofNational Intelligence.

1.8.1. (U) NSAICSS Title I FISA

I.B.1.a. (U) Detasking Delays

(TS//SI/~W)

discovered that selectors for foreign intelligence targets had not been detasked ~~----,;J All selectors have ...

\ ...

·. been detasked, and non-compliant data has been marked for purging.

-an .. an~yst discovered that a selectrit.a~soci~~d ~-----,:----.---'---.had .. :iJeeiiTnistakenl included on ·a.J{:'!n¢\.val of

;;;;;;;;~;;;;;;;;;;;:;;:u ... ::::f_./ .· .... ··· (b) (1)

.... ·· (b) (3)-P.L. 86-36

I.

8. 1

b (:~9::)1

~0

rized T a rgetl ng I art aniiiY~t ~;::~::;: that communications

collected pursuant to FISA authority did not belong to the FISC-approved target. The selector used to target the communications was detasked and non-compliant data was marked for purging.

(TS//SIHNF) I

Data collected from the selector has been requested to be purged.

(TSffSI/~~)-1 I an analyst learned that I I r-1 --~.:.:::.:..:..:::.::.:.:.::::.:.:..!::::=======..::.:..::.:~pwd been using the telephone mlmpyf"for a

Ll----..~~----~~~---:------lf Th~tefephon~selector was detasked1i:~£id non-

./ .. . / ?"mpliant data was marked for purging. ··························· :·: / ....... .;~~~:· 111 (b) ( 1) (b) ( 3) - P. L. 8 6-3 6 (b) (3)-P.L. 86-36 (b) (3)-18 USC 798

T&P 8ECRETM}J;T, fLEialr lfE YHOLEP:!NOFORN 8

(b) (3) -50 usc 3024 (i)


DOCI .D: 4165220 (b) (1)

i (b) ( 3) - P. L. 8 6-3 6 1 (b) (3) -18 usc 798

(TS/ISI/fl..fi!)I I an analyst discovered that a tasked telelfLone selector was associa:ted··with a U.S. entity. The data wa.~ __ purgedl I /

.... ······· ...........

an analyst discovered that collection/occurring .... -~--.....,;.;...;....;;....;..-.;o;;;;-~,;,_-.,.o-n-a-ce~l-::-h-:Jl-ar-· t~ele hone selector associated with a F~SC-approved

,,:::::::::::::::::::::::""'"'faiget ' The selector ~~~--------------~-------------~

(b· ,:·~·;t·j;~;;_::i·~s~~~t:~~~-... ~..---------' ·.:.-:::::::: ·. ·· ... ···.. . .. (tsii$1/'/~i I it was discovered that a cellular telephone number

..... :<::::::· autlioriz~d for.coHectipn under a FISC"Otder

and non-com liant data was

1.8. 1.c. (U) D~tabase Queries

(H5//SI/!NFH I an analyst performed a query in a raw traffic database on the selectors associated with a target after it had been determined that the target was no longer considered to be an agent of a foreign power. Non- compliant data was marked for purging.

. ... ··?t:b) (1) 1.8. 1.d. (U) Data=Handling Errors ........ ······· ./· \(b:'t't2..l-P. L. 86-36

~T~Sihffii) I IWlrii; ;~vestfi!'atitk ~; i;dile~t of improper handling of I·NSA discovered /that a~1alysts 'it~ vado~li;\_ organizations were not handling Title I FISA data properly. NSA pr9Vided t~emedial t'r(linin!(tq·apalysts who access Title I FISA data. _. ' ·. ··<::::: · ...

st \discovered tha:tr----....;..,.-.;;.,. ~

!1.8.2. fSh'REL TO USA. FJ=·~·?I ..... _ ----------~'-' ..................................................................................................... ························

(U) Nothing to repott. (b) (1) (b) (3)-P.L. 86-36

1.8.3. (TSt/Sim~F) Business Records (BR) Order (b) (3)-50 usc 3024 (i)

1.8.3.a. (U) Data-Handling Error

(T£11£JIIJ>lE) I lit-was discovel'ed fliafl.jietad~l ( 1 l _ obtained under the FISA BR Comt Order had been released m an e-mailCJcoimterpdt¥J (

3 l P · L •

without required approval. The personnel involved were counseled on the proper dissemination procedures. Ultimately, the required approval was obtained, and, therefore, the e-mail was not recalled.

TOP SECRE'h~<W·/F,fLENT lf:E J'{l·OLEJS'HOFORN 9

86-36


DOC:ID: 4165220 TOl" SECR£f;$'S1/f'ALEN'f KEYtffJLEtlNtJF01t!V

1.8.4. (U) FISA Amendments Act (FAA)

(UNFOUO) Some incidents may involve more than one authority (e.g. E.O. 12333, NSNCSS Title I FISA, FAA). Incidents involving more than one authority are included in the section for each involved authority. Thus, a single incident may produce multiple entries in this report.

I.B.4.a. (U) FAA Section 702 . ...-\pl (3)-P.L. 86-36

(UHFOUO? NSNCSS has implemented a process to ensure that FAA §792 data re uired to be urged is urged from NSNCSS databases. NSA created a

compliant data that should be purged.

I.B.4.a.i. (U) Tasking Errors

(Tg//SI//REL TO USA, F"V"E:Y) Op,O occasions during the fourth quarter, selectors were incorrectly tasked because oftypographical errors. The selectors were detasked, and the information has been purged. No re.ports were issued.

(TS//SM'REL TO USt\.F\'EY) O.t:t-Ooccasions, it was discovered that a selector had been tasked in error because...the target . .did not meet the criteria of an FAA § 702 certification. The selectors have been (jetasked, _;:uid. the non-compliant data has been purged. No reports were issued. · .·

.··

(TS/fSI//flELTO US~, F\>"E~t) it was discovered that a selector had been erroneously.·tasked begause information receiy.ed about the target's us~ .statu.~ .. ·had .l}Otbeen ?..'\sse~· to the analyst befonrihe selector was approved for t.asking. In addttlOt)(the.selector .had remamed on ~.S~cskt I because of confi1ston about whic,h an.alyst w9uld.·submit th~.,.d.eta:§k' request. All non-compliant data has been marked for p~1 rg;i~1g ~· ang. nO' reports :y.et:e·ts'su ed .

. ::: : : : ·· ·(~~//Sflfltiit·";~ USA, .. !.7\f~"ll I an analyst discovered that a ··~f~l,~cto·flasked ~mc.l.ertheFAA §702 ( lcetiification should have been

....... ··fas~c.~d undetthel !certification. The selector was detasked I ··~@.~i:~:i•/: •••. ::::.:·· ·····~~~~ •. ~~~.~1~I~~cDmpliant··data··wasiiiai'l~edf61:pi1i:g1ng. .___ ______ _.

(b) I h"~:t,~:;;,~:~~~£~EU8A FVIlY)I ! ... Upon discoJ:~~\~ed:~~~t';;;e~~:•t:n~~~~:~;Y detasked: .j'h.enop-compliant data was marked for purging. ·

. ········.... ... I it was dis~~~ereg that a sei~ctor had been retasked

st had not followe.d ro er taskin rtice.dures. The selector had been

data has been marked for purging.

(b) (1) (b) (3) -P.L. 86-36 (b) (3) -18 usc 798

TOP 8ECRETA~~y};T,fER¥T lfEJ'llDLEJ7'hrOFOR!<l 10

(b) (1) (b)(3)-P.L. 86-36 (b) (3)-50 usc 3024(i)


DOCID: 4165220 f(JP SfCRE'fl'IS1/'fALE!•lT IlEJWOLE;~'ftTOFORN

(TSHSI//REL TO USA, FVf.)}·l I it was discovered that a selector associated with a valid foreign ,.intelligence target had been erroneously tasked because of a typographical error. Beli.eved"to be associated with a USP, the incorrect selector had been detasked, and non7.co111pliant data has been marked for purging .

.... · (:rg,~-g~,~~L TO USA"_.f..YE¥)1 I an analyst learned that a selector .... bact··be. en err?.I1.~9.!!.Sly.tasked'liecause an IC arncy analyst h~d passed an incorrect selector. The

.... ·:::: ..... ~.<::l..~~!O.:~'::.~~§ .. d.etaskedl _and non-comphant data has been marked for

··rJ5:i·:_~''i:~:::~·:.::::::::::~~~:~-~-~~~. ( b l ( 3 l .::·p., L..,_ .. ~-~-= 3 ~'t'£/lgi//1\W)I I an analyst discovered I .. .. ·1 that

a valid"foreign intelligence target had been in communications with another person, yvhile both were located TiilhelJ.tuted States. All non-compliant data associated with the don6.~~tld. l communication waspi.li:ged .. and norepmts were issued. (b) (3 )-P.L. 86- 36

' ·····.... (b) (3) -50 usc 3024 (i)

(TS//Sih'REL TO US2'\; F\~Y)··onOoccasions, an analyst tasked a selector believed to be associated with a valid foreign intelligence target, but after tasking, the analyst received proof that the target was either a USP or not the intended target. In each situation, the selector was detasked and the non-compliant data was purged.

{Also included are occasions when ~~----~--~--~ ~------------------~ States could not be confirmed.)

I.B.4.a.iii. (U) Database Queries

...................... {b) (1) ... ,,,,,,,,,,,, .. ,............ (~) ( 3 ) - P . L . 8 6-3 6

····::.-····· ······················

('fS//Sih'iti!L TO USA, fFv'EY) on0o:c0asi6~~ d~uing the fourth quarter, analY·st~ performed in FAA §702 data overly_I;JroactOrpoorly constmcted database ueries that oh~hhally selected or returned infonn~tion·about USPs. These queries used

'-----....1 thafproduced imprecise results.

an analyst performed a quety in an FAA §702 raw traffic data ase using selectors associated with a USP target approved under FAA § 705(b) authority. The queries were not performed in accordance with NSA internal procedures. The quety and the results were deleted.

TOP SECRET;/1W/rALEltlf IfE J'Il-()LE;SWOFOfl:'N 11

(b) (1) (b) (3)-P.L. 86-36


.DOC.I.D: 4165220 .. (b) (1)

fOP 8ECR£'fl~'Sl/TALEl•lf KEYtfOLE77NOFOtuv~.-... (b l ( 3 l - P. L. 8 6-3 6 (b) (3) -50 usc 3024 (i)

... ·· The first analyst immediately detasked the selector I lftnd deleted the quety and the results the following day. Both analysts were counsel~d ... on the prop~r procedures for ensuring that all selectors associated with a target are deta~ked. ·

.····

(TSIL/S!I//RJ~:L TO USA. F¥EY)I __ .. ..- l-an._;:1uditor discovet:M that an analyst had performed a que1y in ani bf a raw traffic ·aatabas~ __ on a sel~ctor known to be a USP. Upon being told of the mistake, the analyst inunediately deleted"lhe.qt~_ety and the results. ___ ....... :·-,,, (b) ( 1)

························ .. . (b)(3)-P.L.

('f8//8I/ffl:EL l'O USA, FV-EY) I IIIh .. ai~~l~st mist~ke~ly queried on a selector associated with a USP as a result of not being familiar with the pew :fimctionality provided by the quety form. The analyst realized her mistake immeg_ia:tely and deleted the quety and the results.

. .. ··········

(TSHSI/·/HF) ·analysts performed queries on selectors associated with a USP in a raw traffic database without conducting the necessary research on the selectors. The queries and the results were deleted.

. .... ········ ········

.----=J~~±:ti~!::::~:±H~i:t~~L-------..laru'l2.i·a~--~:!£1d!!,.it~o~r_£d~iscqv6~:ed that, on

~~--~~~-r--~~--~~~-----~~~~~----~~~inanFAJ\ §702 raw traffic database using seleeto-rs--associatect,-~~~~~:~::l~~~~l.::IJ§~,,~;;;.\ I lthequery--·and·the·resnlts·weYe ... clel'eted: ~?. T~pgrts ':".~~::::;r.ssued. ~~~ ~ ~; ~ _ P. L.

(TSHSINREL JO USit.?..f.)'EY-}1-------· ......... .......... __ l:rui:aiiii~st discovered t=J I jselectoi·s associated with an indi_yi_duar who was not the intended target and who had traveled to the United States. Gselector that was correctly associated with the

86-36

86-36

86-36

intended target was queried when the target was 111 the United States. ·"·'!hl. ( 1 l . >·· (b}:(S) -P. L. 86-36

I.B.4.a.iv (U) Detasking Delays it ~YasdiS~~;~~:~ th:t / / tb}(_:I0

5Q ~sc 3024 til

causin.g a delay in detasking ofupJo24hours on some reqt1ests. L.-----------:i;,~-..J I .- .- ldeiask selectors immediately upon request.

--~--_J~~~~~--------------_JUilt~w~a!s]d~is~C£OV~e~r~ed~tl~1a~------------------~ ......

1;;; ,;

1 : itlllnediately detasked and the non -comp!iantY~~~~~:::e~d 0 io~h;u~~~~ the selectors were

( b l ( 3 l - P • L · 8 6 - 3 6 ('f:Sh':SI77ML .. ¥6U8A;· FVr7rl<) it was discovered that selectors associated with valid foreign intelligence targets had remained on task while the targets

T01n 8ECREn~'J,'fA!ENT !fEYHO!EklV.QFORN 12


DOCID: 4165220

were in the United State~,.-

.·······

_...... fFSh'SI/;=L 1'0 USA, FVEY)! I it was discov<:!re.d.that-~..1 ----:-~:-:------A ,... __ .... 1 .. ---···,... _ lthe foreign intelligence

........ ,...::::::::..·· target _§~lectochad rem(l~JJ~d .. on-task·whil€i"'the target was in the United States. The selector was .... ',,,,,,,::::··_ ........... ··d:~IiislC.ed - Non-compliant data has

-!~:@:~:;;~:;,:~;;;;;;;;:;:;_;;;;:.;·;·~:~~~~::fl1.?.1·~~~~ .. -~?_I:.P.~~r¥~ng. (b) (

3-r~-P--... r..:. ...... ~--~-=-~--~ .. ·(;-~;;;si/~itEi .. i6-u§A,::~;~;Y)T.......... ··m .. was· a is covered "thatOselectors

.. associaled---w.H.~~- a foreign intelligence target had remained on task while the target was in the United States fi:omf.___ I The delay occun'ed because ajunior analyst was unaware ofthedet.asking procedures. The selectors were not detasked because the target returned to a foreign locaiion-1 I All non-compliant data from

1..---------------------~ has been marked for purging.

ITS "Sf I 'PEL TQ us ~ F' 'P' T\ \T J7 II~ T o fi, Y:r:;IJ ,.

.----,lit-was .. dis.~Qyered thatc=JselectQrs associated with valid foreign intelligence targets l1rid remained on task wheiith(ftargetsarriv.e..fi.jj'th:eUnited.S.~ates. On each occasion, the analyst

.... ···· ' "'11€l:ll, .. /.-·"···

\b) (1) (~:{._ (3)-P.L. 86-36

--~(~r~S#h'St;HI+I-,'fBR-\:EF1L~1':POHU-¥.S~A;Ir-fFPt'vlfi'fi:~7{'T)I c:::::::::=.:====-=:::::::::::=::::::1 was discovered that selectors associated with on task when the targets were in the United States.

.. ··non~=~~~~~~==-----------------------------------~ ..... ::·::•;(b) ( 1)

_____ .. : : > f (b) ( 3) - P • L.

(T5//5I//KEL TO USA FVEY)I ~~iiai~6i0st dis9overed that a selector associated with a valid foreign intelligence target had i:emained 011task when the target arrived in the United Statesl I Ti1e analyst believed that he had detasked the selector at that time. but it actually had remained on task I · · I All non-compliant data was purged, and no reports were issued.

(Tg,~tgif/REL TO USA, FVEY) I I it was discovered that a selector associated with a valid foreign intelligence target h_ad remained on task while the target was in the United States from I I The selector remained tasked because the target had returned to a foreign location. The non-compliant data was purged.

TOP 8ECRET;HS'l/TALEl'lT lfEYllOl,E,S'NO~llORJV 13

86-36


DOCID: 4165220 TOP 8fJCREF1S'Sf/FALEl'lT ifE I'JIVJL.E;S'ti'OFOfl:N

(TSf/SI//REL TO USA, FYEY)I 1-ii!p analyst discovered that a selector associated with a valid forei n intelli ence tar et had reniain~d on task when the target visited the United States from ·When·the analyst was originally notified that his . .target was in the United ·state.s.l .I the

e c etasking ;a:s· ·not executed .... When thEi"anaJys_t was notified .----------~--------ilthat--the .. target .. wasJo.c.&t~.<l.i_~:t.Ii~:pnited-.. Stat¢.:~;:tJ:l,e s.e"lector

All non-compliant data was p~~r·:~~: ... . :: ::::::::::: :::::::·:::::::::::;:;::::;;;;;;:'i::~t~ ~ ~; _ P. L.

(TSh'SI//NF) ·NSA"aiiaf-~t_$.discoVei:·;;;d that a selector h~d · remained on task because of a software error~.;,;;;;;;;.:::: _______ ~,--------11---,

·The system error was corrected L.,N~o-n--c-o-n-1p'""l.,..i at_l_t_d,_a-ta-.,..ha_s_b,_e_e_n_r_n_ru'""'·I-ce'""d.-!for purging. 1------------1

ffS/}81/iREL TO USA, F'V''fnj I I it-':Y.as discovered that c:J selectors associated with0valid.fo..reign intelligence tru·gets had r:ema~p.ed on task while ~he target was in the United States. The seled6i'swere detl'_ls~ced atld the non~compJiant data w~s purged. ····· ·· ·

(T SHSI//lq'ff ) an analysr 'di sc6Vel'ed' tf.~~rO:i.~r;.¢.f.B'~i-"'!!iiiirt1 ) ( 1 )

associated with a valid foreign intelligence tru·get hac;l. . .remained:::9.Ii.h1sk·:W.llile the target Jct'sl ( 3 l - P • L •

visiting the United States fro_1.1.1.L .............. ··· ······ I·Tlie.:·_(!l1alys(was awru·e on I lthanlie .. target was in the United _§tates··aiid believed that the selectors had been detasked that day. I ltlie. ru1alyst realized that the selectors had not been detasked but did not request the selectors to be detasked at that time because the target had returned to a foreign location. All non-compliru1t data was purged, and no rep01ts were issued.

(TSHSI//REL TO USA, FVEY) I lananalyscdis~qy~!;ea:::tij[{rE),( 1 l collection had occurred olr-lselectoYEf .. assodated with a valid foreii!Jl:::intel'fiii(mce tar2:~f( (-(l -P · L.

visiting the United States. I ........ ··::::::::::::... ·1 ....... ··· .. lThe collection occurred because the ~

lthe.selectors were detasked and the non-compliant data was purged. No ~----...,...,-~

reports were issued.

(TS//Sih'REL 1'0 USA, FV'EYJ laqanalyst discovered that,O selectors associated with a valid forei n intelli ence tar et had reni.ai11ed on task when tlie tar et was in the United States. / I I resulting-in col ee-tior1 .. ofthe tru·geLwbile .. inthe .. Unit~d S.tEtJt::f 1'}.~ seled;~~s

86-36

86-36

86-36

were detasked and the non-compliant data was purged. >> (b) ( 1 l ...... ······ . · (b).(3)-P.L. 86-36

(TSI/SII/REL TO USA FVEY~ litV,;~sclis<;overecl that a seleCtor associated with valid forei n intelli ence tru· et had remained on task .. wlule the tar et was in the. United States.

because the tru·get had returned to a foreign location. for purging.

lOP SECRE11/,$11TALt!:N'f l{EYI10LE;SHOPOR1'1 14


DOCID: 4165220 T"l7P S't!CtmT/J'SIITALElv T IC"EY110lEII1v0r OKlv

('f3//Sih'REL TO USA, FYEY) I I it was discovered that selectors ence tar ets had remaii1:ed on task while the targets were in

.. All the !?.~l.ect()I:~ were detasked, and the non-co1npliant data w.a~::tnad(ed for ~p-u~rg~u~1g~.-----' ··················· ........................................ .,,,,,::''''''''····

·· · · · · :.::.;r(];) ( 1 )

I.B.4.a.v. (U) Data-Handling Errors ... ·/(b) (3)-P.L. 86-36

{'f3h'SIJ7'f:tfi:L 'fO USA, fi'Vf?tj I l··~~~··~t)aJ?st sent an e-mail, which included an attachment with FAA §702 data, to an IC analyst not auJhy}rized to receive it. Upon discovety, the recipient deleted the e-mail without opening the atta¢'hJt1ent The analyst was counseled on proper data-handling procedures. · ·

(Tg,r,tgl/fRBL TO USA, P\i'EY)I J"atyanalyst sent an e-mail, which included an attachment with FAA §702 data, to three analysts noV authorized to receive it. Upon discovety, the recipients deleted the e-mail and the file to whichj'f:he information was downloaded.

(TS//SI//REL TO U£A, IJ'CEY)I ft was discovered that analysts were storing FAA § 702 data in directories without controlling access to the information. The analysts were using outdated guidance and were unaware ofthe proper procedures for handling FAA §702 data. The analysts were informed ofthe proper procedures, and the data was placed in proper directories.

(TSL/Sl~t;l?k;L TO USA, F\lE .. tj I l~n analyst discovered that software failed to place FAA §702 data in the proper file directoiy that would have provided access controls. Instead, the placement of the FAA §702 defaulted·.to a direcrry Tat could be accessed by unauthorized and untrained personnel, although highly itJ1likely. I ~ha.,t:J .. ¥es to the software were made to ensure the p~:oper place1t1ent ofFAA §702 data. · · ·

(SHREL TO USA, FVEY)I .... ······; l,it:vas disc~vered .. ~hat,l \, ,.1 I lanan~Jy~tlad shared FAA§]02·dat~ wtth a sec9nd ~nalyst not authorized to receive it. Upon discover)< accessto.th~. data was·dis§onti~med ttl~til ~hyisecond

analyst received the proper training on hand I ing FAA §702<iata :;;,.,;;,,;,~;~} ( 1

}

I.B.4.a.vi. (U) Unauthorized Access (b) ( 3 } -P. L.

(TS//811/REL TOlJS.b. F¥EY.)l. . .... ············ ········ · .. ~~ ~itpervisor di~~6vered that a I !analyst was ~~<:;~ssing FAA §702 data from an UI~l:tuthorized location. The analyst was approvedJorFAA §702 data access but then transferred t()t'tnother location on I latwfuch time her access should have been ter~~1it1ated.. •upon discove1y of the incident, the analyst's access to FAA §702 was disconti11,ued .

.. (TS//SIHREL TO USA, F vE y) I ran analyst discovered that another

analyst was accessing FAA §702 data from atJ..tii1authorized location. The analyst was approved for FAA § 702 data access I lbi.Jt then transferred to another location in

TO·P 8-ECRETA1S1J,T,fLENT {(EYi'IOLE~Cf\T.()YORl'l 15

86-36


.. ·· .... ··

DOC.ID: 4165220 f()P S£CRETMH/TJiLEA'P JfEI'f}{JLE;S'HOFOR:l'l

..... j I at which time her access should have been terminated. Upon discovery ofthe .... ····· .. ·· incident, the analyst's access to FAA §702 was discontinued .

\:P.l (1)

(bl (1l I.B.4.a.vii (U) Systems Error (b) (3) -P.L. 86-36

(Bi-(.3)-P.L. 86-36 (b'):·::c~"l-:-:-50 usc 3024 (i)

\ ··.:·.. · .. •, •,•, '•.

"iT8tt81tt:t:>~jl ..... ··.::: ... . ,

\\: ... ········ ...

tTS,'l'Sb'''~'f.F'

.\\\.

I.B.4.b. (U) FAA Section 704

(U) Section 704 of the FISA provides for the targeting ofUnited States persons located outside the United States pursuant to a particularized comi order.

I.B.4.b.i. (U) Detasking Delays

I.B.4.c. (U) FAA Section 705(b)

(U) Section 705(b) ofthe FISA provides for the targeting ofUnited States persons located outside the United States upon authorization by the Attorney General when comi orders have been obtained authorizing a physical search or electronic surveillance.

I.B.4.c.i. (U) Database Queries

86-36

(TSNSI //?W) I I a database auditordiscov.ered .. tha.t..a.n ~11al yst had performed queriesHonanFAAm§70S:::~ppt(jy~qJi.l)'g'etl : H : H H ... H m ~~ r~ ~ ~-p. L. 8 6-36

(T£f/SIN?if.F) I

.· .·

(TSHSI//i~)l I an analyst was l~Q.ti.fied -byl.-------;l·1h~t a target taske.d utider FAA § 705(b) auth?.~~i.:tY had-returned to tl~~.lJ.~1H.e.d States._! -~-----~

ibi ill : ~~~~~~~:l;,4~=r ::Y!lm,E,;wtJ."'HHN (b) (1) (b) (3) -P.L. 86-36

(b) (3)-P.L. 86-36 16 (b) (3) -50 usc 3024 (i)


DOCID: 4165220 fOP SECRnf;}81/fALEN'f KEYtiOLE;ttvYJFOttiV

The selector was detasked ·-T.Q __ prevent fhture detasking delays. NSA analysts remindedr--------,-o~f~th-.. ~---.~-~~-.~ .... :s.sity toJ ..... -) FAA §705(b) targe s.

I.C. (U) Consensual Collection

(U) Nothing to rep01t.

I. D. (U) Dissemination of U.S. Identities .... ······

.... ············

..-··············

..·· .................... ::::···· ...... -····'

.... ····

.-----·:':_?''{b) ( 1} ... --:_: .. (b) (3}-P.L. 86-36

(T~WSih'NF) The NSA/CSS _s:ntefp-~~i~~ issued I I·SIG:nrf product reports during the fomth qumter ofCY2012. In0pi:oduct re o11s, disseminations _:Were found to be improper, and the repotts were recalled as NSA/CSS and ·analysts learned of USPs, U.S. organizations, or U.S. entities named without aut 1onzat10n. data in the recalled reports was deleted as required, and the repot1s were not re-issued or were re-issued with proper minimization.

I.E. (U) Counterintelligence Activities

(U) Nothing to repot1.

I. F. (U) Detection and Prevention of Violations

re orted, NSA has instituted a rocess to help identity when the United States. NSA' s

Collected data was purged from NSA/CSS's raw traffic repositor!e·s·: .. · ·- -.. ::<;;::;,,_{-~) (1

}

I. G. (U) Other ----::=' ,,, .. --(-1;>} ( 3 l -P. L. 86- 36 (b} ( 3} -P. L. 86-36

(U/~oue, IrCJitisf~i~~~, ::d~~~~~se acces~~s -'Yere not terminated when analysts were deployed or reassigned-t6 another site. Although not cb11sidered violations ofE.O. 12333 or related directives, t.he accesses were terminated in accordance with NSA policy. In addition, there wasOitistance ofunauthorized access to raw SIGINT and0instances of account sharing during the quat1er.

II. (U) NSAICSS Office of the Inspector General (OIG) Intelligence Oversight (10) Inspections, Investigations, and Special Studies

(UNFOUO) During the fourth quarter ofCY2012, the OIG reviewed various NSA/CSS intelligence activities to determine whether they had been conducted in accordance with statutes, E.O.s, AG-approved procedures, and Depat1ment ofDefense and internal directives. The problems uncovered were routine and the reviews showed that operating elements understand the restrictions on NSA/CSS activities.

TOP 813CRETJS~S'h'FALE¥T XEYllOLEJSCfVOPOR:N 17


.. ·\:(!.)) {1) DOCID: 4165220 .... ····· (~.) {3)-P.L. 86-36

f(JP SECltEf17SllfALENT 1YEI"IIQLEt!'Aro;~r ~~-r-~-.;_~ =;~ ~~~ ;;~4 {il

.· .·

.. ··················

II.A. (GfYREL TO USA, FVE'{)I~=--·-·" .... _-----------~----~-~ fS/fREL TOU§_Ar F'VEY). During the field inspection of I · 'J

.__ _____ __.I an 10 inspector reviewed 10 program management, 10 training provided to personnel assigned to the site, and procedures for ensuring that all site personnel received required 10 training. The inspector's overall assessment was that the site had a mdimentary 10 program that needed fhrther documentation and development. The OIG recommended that the site document its 10 processes and procedures and conduct informal 10 training sessions for site personnel.

II.B. (U) Special Study of the Research Directorate's {RD) Compliance Program

(U/i'fi'OUO) The NSA OIG summarized the results of a review ofthe NSA RD's Com liance Proaram in are o1i publi,?hedl l The review, .~?.~}Q.ucted·CJ

fqcused on the operation of the progtJUn-bythe.Directorate' s 10 L.c-o-n-1p_o_n_e_nt:-. ~Ti'l'lT""le-re-v"'"te-.. w-. _ .... _I-re~"iitlfied two areas of improvemerif"fol· the 10 compliance program: program docu_mentaHon and enhan_<::~.d contr6lS'to .. monitor 10 training compliance for the RD workforce: .· .. ·

.· ..... :::·· .. ::::l:I_~:.·::·(U)·s·~~~i:~-~tudy: Assessment of Management Controls Over FAA §702 ·'f~=;=:::{~) -P. L. 86-36

· · --. ... (U//fOUO) The NSA OIG reported the results of a review of the management controls .... ilnpl~J.nented to provide reasonable assurance of compliance with FAA §702. The report,

publisll:ed .. j !identified one instance of non-compliance and included recommendations to improve the overall control environment in which FAA § 702 authority is exercised. Information received after the report's issuance that had not been made available to the OIG during the initial review indicated that there had been no instance ofnon-compliance and that the control procedures are designed to comply with FAA §702.

II.D. (U) Advisory Report on._l ___ _.1-Qompliance with NSAICSS Authorities

(U/ft\'OU971 ltll~-NSA OIG conducted a review orl._~=---' a teclmology demonstration that uses cloud computing: In ~n advisory re oti ubUshec.JQ I ltheQI9- found that controls on dataingestj9n and on . ·· atiici ants required manual implementatiO'iltocomply with NSA/CSS authm~ities, leaving.' compliance measures vulnerable to hum~li" e'i'i'Dr: Furthermore .. tltese control~,_...~..,._e .... re-no_t _ ___. sustainable outside the tightly controlled! ~e~~~ii:oiiiiJ~gt: .. :-:-:: .. ·

>,;::::!··(b) (3)-P.L. 86-36

II.E. (U) Ongoing Studies

(U//fOUO) The following special studies were initiated during the quarter and will be

summarized in subsequent qn~ierly reports: I/• ·· • (U/ffOUO) FAA §702 ,. _ • (U) Special Study: Assessment ofManagefi1ent Controls Over FAA § 702 -Revision • (U) Special Study o~ !Auditing Control Framework for Signals

Intelligence System Queries

T0;9 8£CRET;S'!H·/f; h'SE~'T KE I'."lO/:;E,~?/'lOFOR:}V 18


.DOCI.D: 4165220

• • ..

TOP 8t!:CKEfJ7'!51lfALElv'f lit!:l'ttOLE/fNOFOJUv

(U) Special Study ofthel 1·-sysfe.i}; . ·········· (b}(3}-P.L. 86-36

(U) Special Study ofthe Technology Directorate Mission Compliance Program (U) Special Study ofthe Information Assurance Directorate Office ofOversight and Compliance Mission Compliance Program

II.F. (U) Misuse of the U.S. SIGINT System

(U) Nothing to rep01t

II. G. (U) Congressional and 10 Board Notifications

(8//£1//~W) I (Nsknotrfied theToiigi;ess1oi1afTi1ieilig~t;~~ ( b l ( ~ l _ committees about a Title IFISA compliance incident involving the misapplicatioi1 of cett~J ( l P · L •

provisions ofNSA' s minimization procedures. After learning of one instance in which domestic communications encountered in the course of authorized collection had not been handled as required, senior NSA managers initiated a fhll-scale review. Although the review is ongoing, they have learned that there was no indication ofwillfbl non-compliance ofminimization procedures; personnel seem to have misapplied those procedures. Retraining sessions are ongomg.

II.H. (U) Other Notifications

(TSt/SI//tiF) The AG granted NSNCSS approval forOi~1telligence -related collection activities associated with USP hostage and detainee cases. · ·.

(b) (1} Ill. (U) Substantive Changes to the NSAICSS 10 Program (bl (3}-P.L. 86-36

A. (U) ········

86-36

(._U_f.I.:_IF_O_U_G_)"_A_s_r_ep_o_ti_e_d_i_n_tl_le-S-ec_o_n_d_Q_t_Jm_t_e_r _C .... Y20 ~-~ ~~~~~~;;· NSA/CS.S is developing a

tool designed to automate the process of submitting mission compliance incident i;eports .. ft.cross the worldwide NSNCSS enterprise. TheOwiH become·the·-:AgeiicY's cei'ih~[joof::foi::""(jb l ( 3 l - P. L. 8 6-3 6

reporting all potential mission compliance incidents and will proy,iq.~,,sudf'f>'e11.ef1ts as a l streamlined management process, a central repositq.ry.,.~o.ckh1etHcs.data to su Oli root cause identification and trend analysis. TheQi.s::exp:e:cted to be implemented With the im lementation of theQ NSA:Wiff be able to perform comprehensive tren ana ysts

IV. (U) Changes to NSAICSS Published Directives or Policies Concerning Intelligence, Counterintelligence, or Intelligence -Related Activities and the Reason for the Changes

(U) Nothing to repott.

V. (U) Procedures Governing the Activities of DoD Intelligence Components that Affect USP (DoD Directive 5240.1-R, Procedure 15) Inquiries or Matters Related to 10 Programs

TOY' 8fJCRET;Sf:JYlFALEl,lT 1.'fE YNOLE!S'NOFORN 19


.. 1 O"P SP:CttET/!SilfALElv"'f IiEYllfJtEI~'f{OPOR:N

- ·-"·- -----~------·- -------.. ------- ------·~---- ---- .-.-·-- .. ·<::''''''\1:;);) ( 1) .............. ,..· ('b)..(3) -P.L. 86-36

............. ·· ..... · o3::l. hl._-so usc 3024 (il ... -·

___ ... ---------····· ... . · .. ·.

(S//UF) The NSA OIG is cont~puh1if .. its investigatiqtl'·i~~to an allegation report~. in th~·-..... Third Quarter CY2012 report ~hat··· .... ·· .... I 1 ..... _.-··

_.-·

(TSh'SIHNF~ .... I

\\\'

1 j··NSA verbally notified the Office ofthe Assistant to the Secretmy ofDefense tor Intelligence Oversight ofthis issue.

(U) NSNCSS has taken the following remedial actions:

'~~i;,t~'i'·'";;;;;; :•••••; ~ :. .::::;(ICSS has obtained ann royal fum the Uuderse~etarv ofDefense for

0?}-..{'3.,) .. ~-P .. ,_L. 86-36t~..._ ...... ...;; .... ·;;;;.; .. : ...... _:~---------------....,j] (b-) (3_)';;;:so"·usc 3024 (il ................................ .

· ---. < ~ tffl!)~~~:ss is worklDgW!tlrthq

- _\ \-:-·--.~·=··.:~-;o_~~coc (~~1:fF}II""'" ---"····..,;;;;;· ............ ··~· ..... -...... ------------------, .,.__ ________ · ... _ .. __..;;.;..~--'

- ~~-- _· ~-(BNFOUO) -NSNCSS does not anticipate that thisl _ -~~~-j~--~-~:j~il: __ I~~v~.-~!! effect on national security or internatiO~-:::'n'::'lai-r::-::.e:r.la~ti~o~ns=-. ----------'

---------------.. -------~----:-::-----------=---

----- _ -~~ =-=-=-·.:::=-~-~-:-=-=-=---==-::--==~=-=- -------·- _- --~~ 1 'UP ,.\$ C'RE 17XS1/1 ALEJ~ 1 ... KE J1ltJLE/J'l'l0flORJ»l 20


exhibit j - american civil liberties union · rajesh de general counsel ... case 1:13-cv-09198-at...

Documents